An NDA does not answer questions about AI processing, retention or access. Bring your security team into the evaluation early and ask for evidence about the specific workflow you plan to use.
Inventory the information involved
List product documentation, policy material, learner details, recordings and any customer information that might enter the workflow. Ask which inputs are necessary and whether a fictional or de-identified example can satisfy the training need. Do not upload sensitive material before your organisation approves the use.
Ask where the data goes
Request a current data-flow description covering processing, storage, subprocessors and applicable locations. Ask whether inputs or outputs are used for model training and what contractual controls apply. Separate a human confidentiality agreement from the technical and contractual handling of AI inputs.
Confirm access and retention
Review administrator access, learner access, authentication, retention and deletion. Ask how recordings and assessment results are handled. Confirm the capabilities for your proposed deployment instead of assuming that every control is available on every plan.
Request supporting evidence
Use your security team’s requirements to request relevant audit reports, agreements and technical answers. A certification can support the review, but it does not by itself establish that a particular data use is appropriate. Resolve exceptions with a named owner before starting the pilot.
Keep the first evaluation proportionate
A representative exercise using fictional records can help assess training fit while the formal review proceeds. Ask Solidroad to provide its current security materials and confirm your specific requirements; this checklist is not a promise of a particular hosting or retention configuration.
